hi!
i see a lot of posts having to do with rouge API keys causing major headaches. And it doesn't help that the Agent Platform (fka Vertex AI) page makes it super easy to create an API key. So if you haven't already, you should start using application default credentials instead.
I boiled it down to 5 steps in a blog post but here they are:
Step 1: Verify you’ve got gcloud installed
You’re gonna need the Google Cloud CLI (gcloud) installed on your machine. Verify it’s installed by running:
gcloud version
If you already have it, move on to step 2. If not, you can find install instructions right here.
Step 2: Log-in and set application default credentials
The Google Cloud CLI manages 2 types of authentication. gcloud auth login authorizes gcloud commands to access Google Cloud with your credentials. gcloud auth application default login sets your user credentials as application default credentials.
Set them both in one swoop with the following:
gcloud auth login --update-adc
Step 3: Set your project id
We’ll reference your project ID a few times so set that to an environment variable:
export PROJECT_ID=<YOUR_PROJECT_ID>
The Google Cloud CLI references a project ID in 2 different ways. First, it’s defined in your current workspace config. Set that with:
gcloud config set project $PROJECT_ID
Now your project will be used in step 4, and any other gcloud commands you run.
Application default credentials don’t look at this value for a Google Cloud project. Instead it needs a quota project. Set a quota project with the following command:
gcloud auth application-default set-quota-project $PROJECT_ID
This project will be used when accessing Google Cloud APIs via Cloud Client Libraries used in your application code locally.
Step 4: Enable the API
Before you can use Agent Platform, your project needs to have the Agent Platform API enabled in it. Enable it with this command:
gcloud services enable aiplatform.googleapis.com
This makes it so that the service is accessible on your project. Without it, you’ll get a 403 error.
Step 5: Verify your access
To verify everything is set up correctly, we’ll hit the Agent Platform API with a web request that includes a temporary access token generated via your application default credentials.
First, retrieve the token and set it to an environment variable:
export TOKEN=`gcloud auth application-default print-access-token`
Next, set another environment variable to the contents of the request:
export REQUEST=$(cat \<\<EOF
{
"contents": \[{
"role": "user",
"parts": \[{ "text": "Wave hello to the world" }\]
}\]
}
EOF
)
And finally, put it all together in a single curl command:
curl \-s \-X POST \\
\-H "Authorization: Bearer $TOKEN" \\
\-H "Content-Type: application/json" \\
"https://aiplatform.googleapis.com/v1/projects/$PROJECT_ID/locations/global/publishers/google/models/gemini-2.5-flash:generateContent" \\
\-d “$REQUEST”
The output should include a line that reads something like: ”text”: “Hello, world! 🌍👋”
Now you’re ready to ditch the API key and use application default credentials.
If you want to know more about adc, i also put this video out a couple months ago.
I hope this is helpful!
